CA DDS Office Robbed; Reminder That Physical Security Still Counts

If there was ever doubt that physical security and locking up sensitive data when you leave the office for the day is still very important, let this latest incident at the California Department of Development Services (DDS) remind you to take it seriously. Officials at DDS announced that someone burglarized its office in February of this year putting electronic personal health information (ePHI) of more than 582,000 patients at risk.

Thieves broke into the legal and audits offices of the department in Sacramento. Seemingly, whoever it was did not show interest in the paper records, but ran off with twelve computers. Supposedly the hard drives of the devices were encrypted so the data on them was inaccessible. However, the burglars had access to sensitive information of roughly 15,000 employees, contractors, job applicants, and parents of minors who receive services from DDS. In addition to all of that, they also may have viewed or accessed the PHI of more than half a million of the patients in other ways, such as when they were perusing around the office.

Adding insult to injury, the same offices were vandalized and a fire was started. That fire triggered the sprinkler system, which caused damage to other documents and CDs. Because it has been impossible to determine if any sensitive information was viewed or compromised, DDS is warning that if it was, it included names, medical records, state-issued identifier numbers, services dates and codes, units billed, and amounts paid for any services.

It’s always advised to keep sensitive information locked up whenever any employee, contractor, or other person steps away from the area. It may seem like it’s no big deal if you’re just going to get a cup of coffee, but think about how often you’re stopped halfway to or fro and how long it takes to get back to your desk or office. It can be a significant amount of time and it only takes a thief a few seconds to steal documents or load malware onto a computer.

In this case, the thieves took computers too. Fortunately, they were encrypted which may prevent access to the ePHI. So yes, it is important to encrypt hard drives, for this very reason.

Notifications are being sent to those affected just in case. The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights and has been under investigation by law enforcement.  However, the thieves have not been identified and are still at large.